From: Adrian Bunk <bunk@kernel.org>
Date: Wed, 24 Oct 2007 16:26:00 +0000 (+0200)
Subject: ACPI: EC: fix use-after-free
X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=1544fdbc857cbe8afca16a521d3254346befeb06;p=mv-sheeva.git

ACPI: EC: fix use-after-free

This patch fixes a use-after-free introduced by
commit 30c08574da0ead1a47797ce028218ce5b2de61c7
(ACPI: EC: Add new query handler to list head)

Spotted by the Coverity checker.

Signed-off-by: Adrian Bunk <bunk@kernel.org>
Acked-by: Alexey Starikovskiy <astarikovskiy@suse.de>
Signed-off-by: Len Brown <len.brown@intel.com>
---

diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index bf60b24ebf5..06b78e5e33a 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -445,9 +445,9 @@ EXPORT_SYMBOL_GPL(acpi_ec_add_query_handler);
 
 void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit)
 {
-	struct acpi_ec_query_handler *handler;
+	struct acpi_ec_query_handler *handler, *tmp;
 	mutex_lock(&ec->lock);
-	list_for_each_entry(handler, &ec->list, node) {
+	list_for_each_entry_safe(handler, tmp, &ec->list, node) {
 		if (query_bit == handler->query_bit) {
 			list_del(&handler->node);
 			kfree(handler);